Attribute Filters using DefaultRelyingParty

[Jeffrey Crawford]

If we take away the entry:
    <rp:RelyingParty id="urn:mace:incommon"
                  provider="urn:mace:incommon:ucsc.edu"
                  defaultSigningCredentialRef="IdPCredential">
       <rp:ProfileConfiguration xsi:type="saml:ShibbolethSSOProfile" />
       <rp:ProfileConfiguration xsi:type="saml:SAML1AttributeQueryProfile"
/>
       <rp:ProfileConfiguration
xsi:type="saml:SAML1ArtifactResolutionProfile" />
       <rp:ProfileConfiguration xsi:type="saml:SAML2SSOProfile" />
       <rp:ProfileConfiguration xsi:type="saml:SAML2AttributeQueryProfile"
/>
       <rp:ProfileConfiguration
xsi:type="saml:SAML2ArtifactResolutionProfile" />
    </rp:RelyingParty>

Then and rely on (Defaults used):
    <rp:DefaultRelyingParty provider="urn:mace:incommon:ucsc.edu"
                            defaultSigningCredentialRef="IdPCredential">
.
.
.
    </rp:DefaultRelyingParty>

attribute filters stop working, We are using 2.4.0

Jeffrey E. Crawford
ITS Application Administrator (IdM)
831-459-4365
jeffreyc at ucsc.edu

Both pilots and IT professionals require training and currency before
charging into clouds!
---------------------------------------


On Mon, Mar 31, 2014 at 9:55 AM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 3/31/14, 12:30 PM, "Jeffrey Crawford" <jeffreyc at ucsc.edu> wrote:
> >
> >However we noticed that for entity id's were we didn't have a relying
> >party entry, but were allowed to login because they were caught in the
> >DefaultRelyingParty, the filters we defined stopped
> > working if we used the AttributeRequesterString in the
> >AttributeFilterPolicy.
>
> That's not the case, so you're misinterpreting something.
>
> >Is there a reason why AttributeFilterPolicys AttributeRequesterString
> >would ignore the entity ID and not apply filters if using
> >DefaultRelyingParty as opposed to RelyingParty.
>
> They have literally nothing to do with each other, there's no relationship
> between the two designations.
>
> Whatever you observed is not a bug I have any recollection of, but I
> couldn't say for sure other than that all versions of the IdP going back
> to certainly 2.2 or so when I first ran it definitely support this fine. I
> use it every day that way.
>
> -- Scott
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140331/4ae1f7cb/attachment.html